My guess is the blame lies with insurers, probably keen to automate detection of "fraudulent whiplash claims" based on "the data". They'd get access to the reco

My guess is the blame lies with insurers, probably keen to automate detection of "fraudulent whiplash claims" based on "the data". They'd get access to the records via their claims. This incident should show why sharing of data needs to be on a "need-to-share" basis by default if we want to have any hope of trying to stop this kind of thing in future.